CVE-2026-63643 MagicMirrorOrg CVE debrief

Who should care

Defenders responsible for MagicMirror² installations should assess exposure and prioritize upgrading to version 2.37.0 if vulnerable. This includes operators, platform administrators, and security teams who manage or monitor MagicMirror² deployments. They should review system configurations, verify versions, and monitor for suspicious activity related to the vulnerability.

Why it matters

CVE-2026-63643 allows an attacker to exfiltrate internal-service response data by sending a server-side request without proper SSRF validation in MagicMirror². Defenders should prioritize verifying exposure and upgrading to version 2.37.0 if vulnerable.

• Potential exfiltration of internal-service response data
• Blind request and timing primitive if response is not valid iCal

Technical summary

The ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handler passes these fields to CalendarFetcher, causing a server-side request without SSRF validation and optionally disabling TLS verification. When the response is valid iCal, CALENDAR_EVENTS returns parsed event data to the attacker, allowing internal-service response data to be exfiltrated; other responses still provide a blind request and timing primitive.

Defensive priority

Defenders should prioritize verifying exposure of MagicMirror² installations and upgrading to version 2.37.0 if vulnerable.

Recommended defensive actions

• Verify MagicMirror² installations for exposure
• Upgrade to version 2.37.0 if vulnerable
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates through normal change control

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability was reported through a source reference and affects MagicMirror² installations prior to version 2.37.0. Evidence of exposure should be verified through reviewing system configurations and versions. Defenders should also monitor for suspicious activity related to the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.